From 451afbe75e6aef69f98636d821c0727e05d5f205 Mon Sep 17 00:00:00 2001
From: Alex Kan <29241719+akan72@users.noreply.github.com>
Date: Fri, 29 May 2026 15:10:36 -0400
Subject: [PATCH] Harden assimilate.sh: arch-aware delta, quoted $HOME, perms

- delta install: detect arch with uname -m. Apple Silicon uses the pinned
  aarch64-apple-darwin tarball; Intel Macs fall back to 'brew install git-delta'
  (delta ships no x86_64-apple-darwin build, so there's no pinned tarball to verify)
- bash_profile: quote $HOME in the .bashrc test/source (handles paths with spaces)
- chmod 600 ~/.gitconfig and chmod 700 ~/.ssh (when present) after symlinking
---
 assimilate.sh | 24 +++++++++++++++---------
 bash_profile  |  4 ++--
 2 files changed, 17 insertions(+), 11 deletions(-)

diff --git a/assimilate.sh b/assimilate.sh
index ab21e14..bacc724 100755
--- a/assimilate.sh
+++ b/assimilate.sh
@@ -67,6 +67,10 @@ sym claude/statusline.sh            .claude/statusline.sh
 sym agent-instructions.md           .claude/CLAUDE.md
 sym agent-instructions.md           .codex/AGENTS.md
 
+# Lock down sensitive symlink targets (chmod follows the symlink to the repo file).
+chmod 600 "$HOME/.gitconfig"
+[ -d "$HOME/.ssh" ] && chmod 700 "$HOME/.ssh"
+
 # bashrc: symlinked on macOS; sourced from a stub on Linux.
 # On the EC2 dev box, user_data appends a secrets/region block to .bashrc after
 # this script runs. If .bashrc were a symlink into the repo, those appends would
@@ -125,8 +129,8 @@ if [ ! -d "$HOME/.cargo" ]; then
     | sh -s -- -y --no-modify-path --default-toolchain 1.95.0
 fi
 
-# Install git-delta from a pinned GitHub release tarball (sidesteps brew bottle ABI drift).
-# Tarball target and SHA256 are platform-specific.
+# Install git-delta from a pinned GitHub release tarball when available.
+# delta 0.19.2 has no Intel macOS archive, so that platform uses Homebrew.
 DELTA_VERSION=0.19.2
 DELTA_BIN="$HOME/.local/bin/delta"
 
@@ -139,6 +143,12 @@ case "$OS-$ARCH" in
     DELTA_TARGET=x86_64-unknown-linux-gnu
     DELTA_SHA256=8e695c5f586a8c53d6c3b01be0b4a422ed218bfed2a56191caebe373a1c18ab2
     ;;
+  Darwin-x86_64)
+    DELTA_TARGET=""
+    if [ "$("$DELTA_BIN" --version 2>/dev/null | awk '{print $2}')" != "$DELTA_VERSION" ]; then
+      brew install git-delta
+    fi
+    ;;
   *)
     echo "WARN: no delta build pinned for $OS-$ARCH — skipping delta install" >&2
     DELTA_TARGET=""
@@ -148,14 +158,10 @@ esac
 if [ -n "$DELTA_TARGET" ] && { [ ! -x "$DELTA_BIN" ] || [ "$("$DELTA_BIN" --version 2>/dev/null | awk '{print $2}')" != "$DELTA_VERSION" ]; }; then
   tmp=$(mktemp -d)
   curl -fsSL "https://github.com/dandavison/delta/releases/download/${DELTA_VERSION}/delta-${DELTA_VERSION}-${DELTA_TARGET}.tar.gz" -o "$tmp/delta.tar.gz"
-  if [ -n "$DELTA_SHA256" ]; then
-    if command -v sha256sum >/dev/null; then
-      echo "${DELTA_SHA256}  $tmp/delta.tar.gz" | sha256sum -c -
-    else
-      echo "${DELTA_SHA256}  $tmp/delta.tar.gz" | shasum -a 256 -c -
-    fi
+  if command -v sha256sum >/dev/null; then
+    echo "${DELTA_SHA256}  $tmp/delta.tar.gz" | sha256sum -c -
   else
-    echo "WARN: no DELTA_SHA256 pinned for $OS-$ARCH — integrity check skipped" >&2
+    echo "${DELTA_SHA256}  $tmp/delta.tar.gz" | shasum -a 256 -c -
   fi
   mkdir -p "$HOME/.local/bin"
   tar -xzf "$tmp/delta.tar.gz" -C "$tmp"
diff --git a/bash_profile b/bash_profile
index ed0d107..cddefc9 100644
--- a/bash_profile
+++ b/bash_profile
@@ -1,3 +1,3 @@
-if [ -f $HOME/.bashrc ]; then
-    source $HOME/.bashrc
+if [ -f "$HOME/.bashrc" ]; then
+    source "$HOME/.bashrc"
 fi